The present specification generally relates to security in relation to data uploaded to a service cloud (i.e. a cloud-based service entity providing at least (but not limited to) file services, e.g. download and upload of files) and stored there and/or downloaded from the cloud via several interfaces and transmission services. In modern communication networks, security is a vital issue, and attacks on network and data security tend to be increasing in terms of both number and complexity.
Salesforce.com (“Salesforce”)® is the most commonly used enterprise cloud ecosystem. It is noted that although problems underlying the present invention are explained on the basis of Salesforce® as an example of a file service cloud (or more general service cloud providing e.g. software as a service (SaaS), platform as a service (PaaS)), these problems presently also arise from comparable other cloud solutions.
Salesforce® has started as a customer relationship management (CRM) software in the cloud, and turned into PaaS, allowing organizations design and customize their business processes without no software evolved. According to this concept, leveraging Salesforce application programming interfaces (API), Apex (a proprietary Java®-like programming language), and VisualForce® (a special tool to design Salesforce® user interface (UI) pages), organizations can extend functionality of Salesforce platform and integrate it with internal/external systems.
Salesforce® provides for an easy installation of applications to enhance the Salesforce® basic system of a certain customer. The applications are provided by an application exchange service (“AppExchange”).
Examples for such applications range from integrations with various systems (such as MS Office 365®, Dropbox®, Evernote®) to encryption, data loss prevention, user activity and monitoring.
Being a business platform for many organizations enabling direct interaction for and with their partners and customers, Salesforce® as well as similar platforms are assumed to be an attractive target for cyber criminals to conduct targeted attacks. Attackers may for example use the platform as a stepping stone to get inside organization networks via respective cloud services. For example, one possible scenario of such an attack would be by sending an email message with a specifically crafted document or a web link to the organization's customer care/support system, tempting a support engineer to open it.
Providing means impeding or avoiding such attack and being able to interact with the cloud's basic system via established interfaces would increase security of the cloud system.
Accordingly, it is a general task of the present application to provide for such security increasing measures.
Known approaches being so-called cloud access security brokers (CASB) which may be implemented as Hyper Text Transfer Protocol Secure (HTTPS) reverse-proxy acting as a gateway (GW) 13 between a client/user (i.e. a remote accessing entity) 11 and the cloud (e.g. a service cloud entity) 12 as shown in FIG. 1. An obvious weakness of the approach using CASB is that an attacker can bypass the GW 13 and connect the cloud 12 directly.
In a different approach, in incoming file upon an upload is scanned utilizing resources of the cloud during the upload handling. However, according to such approach a risk and thus a problem arises that malicious or harmful content might not be detected immediately in a file upon an upload. As an example for such situation, there might be unknown zero-day vulnerability exploited by malware that an antivirus or other security tool cannot detect until the exploit becomes available for security researchers. Hence, there is a potential risk that even later on (after the exploit became available for security researchers) the malicious or harmful content may be downloaded by users to their computers and malware may spread inside organization.
A multi-tenant cloud platform like Salesforce® (and similar cloud systems) puts some constraints on how malware scanning and advanced threat analysis can be implemented in efficient way. Further, the above-mentioned Apex runtime engine may enforce governor limits to ensure that 3rd party code and processes does not monopolize shared resources.
Although Salesforce.com® is considered a secure platform covering various aspects of system and application level security, such as authentication, rules, user permission and roles, and is able to secure data at rest, in use an in motion, however, their cloud platform cannot guarantee content security and it becomes each organization's own responsibility to inspect files and web links uploaded to Salesforce.com® and prevent malicious or disallowed content spreading inside or outside the organization.
To address risks associated with harmful content shared via cloud-based services, F-Secure® has developed a cloud protection solution which compliments the native security capabilities of Salesforce.com® and allows to scan files and URLs posted or opened/downloaded by internal or external users. The solution also provides rich reporting, advanced security analytics and full audit trails, ensuring that incident response is fast and efficient.
The F-Secure cloud protection solution comprises a native Salesforce® application and an F-Secure Security Cloud, which provides content reputation and security services used in other F-Secure and 3rd party products. The application is provisioned via Salesforce AppExchange and can be installed by the administrator to organization's Salesforce instance.
Due to native cloud-to-cloud integration, F-Secure Cloud Protection provides the best protection possible without hindering the use of Salesforce.com. Leveraging internal interfaces of the platform and innovative file scanning logic described in a patent application GB1616665.4, the application brings minimum impact to Salesforce performance and user experience.
Although the F-Secure cloud protection provides benefits when compared with traditional Cloud Access Security Broker (CASB) solutions, it has some drawbacks. because of the execution governors and limits of Salesforce.com®, the existing Cloud Protection application is not capable to scan very large or huge files. More specifically, there is a maximum amount of data and a maximum timeout for REST API callouts that does not allow to send larger files to the security cloud. Moreover, the Salesforce.com® does not allow to split and read large files in smaller data pieces. Files are stored as BLOB data in Salesforce.com® and can only be converted to Base64 string, which would be difficult to handle. Salesforce's Apex runtime puts a limit on memory heap size and opening a large file within Apex code would produce a system exception.
Hence, overcoming the shortcomings of the existing cloud protection solution and enabling efficient and reliable scanning of files uploaded or downloaded to/from a cloud platform like the Salesforce® platform and especially concerning also large files are required. Further, a cloud protection solution allowing optimization of the whole file scanning logic and making the application adaptable and still using cloud resources efficiently is needed.